std::string 上的分段错误

Question

我正在运行的应用程序由于分段错误而在某一时刻停止。 我将尝试争取环境： - 应用程序有一个类 (Generator)，其中包含一个 std::string 成员 (data)，并且该成员被适当地初始化为“HelloWorld”。 - 该对象的指针被传递给另一个类（Product）的成员函数（send1）。一旦我尝试在函数内打印数据的值，它就会给出分段错误。如果我在调用 send1 函数之前尝试打印数据的值，它会被正确打印。

这是 gdb 输出：

(gdb) br Generator::test
Breakpoint 1 at 0x80499ef: file ../app/generator/src/generator.cpp, line 58.
(gdb) br Product::send1
Breakpoint 2 at 0x804a17e: file ../app/configurator/src/product.cpp, line 43.
(gdb) run
[Thread debugging using libthread_db enabled]
[New Thread -1208071520 (LWP 18389)]
[Switching to Thread -1208071520 (LWP 18389)]

Breakpoint 1, Generator::test (this=0x9917020) at ../app/generator/src/generator.cpp:58
58                 cout << "data = " << this->data << endl;
(gdb) n
data = HelloWorld
59                 Product* ptr = new Product;
(gdb) n
60                 bool status = ptr->send1( this );
(gdb) s

Breakpoint 2, Product::send1 (this=0x99170c8, genptr=0x9917020) at ../app/configurator/src/product.cpp:43
43              cout << genptr->data << endl;
(gdb) p genptr->data 
$1 = {static npos = 4294967295, 
  _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>}, 
    _M_p = 0x99170b4 "HelloWorld"}}
(gdb) n

Program received signal SIGSEGV, Segmentation fault.
0x076751e6 in std::operator<< <char, std::char_traits<char>, std::allocator<char> > () from /usr/lib/libstdc++.so.6
(gdb) bt
#0  0x076751e6 in std::operator<< <char, std::char_traits<char>, std::allocator<char> > () from /usr/lib/libstdc++.so.6
#1  0x0804a19a in Product::send1 (this=0x99170c8, genptr=0x9917020) at ../app/configurator/src/product.cpp:43
#2  0x08049a85 in Generator::test (this=0x9917020) at ../app/generator/src/generator.cpp:60
#3  0x08048f4c in Configure::init (this=0x9917008) at ../app/configurator/src/configurator.cpp:89
#4  0x08048c93 in main (argc=1, argv=0xbfed7364) at ../launch/main/src/appLaunch.cpp:20
(gdb) 

这是 valgrind 的输出

valgrind --tool=memcheck --leak-check=yes ./application 
==18328== Memcheck, a memory error detector.
==18328== Copyright (C) 2002-2005, and GNU GPL'd, by Julian Seward et al.
==18328== Using LibVEX rev 1575, a library for dynamic binary translation.
==18328== Copyright (C) 2004-2005, and GNU GPL'd, by OpenWorks LLP.
==18328== Using valgrind-3.1.1, a dynamic binary instrumentation framework.
==18328== Copyright (C) 2000-2005, and GNU GPL'd, by Julian Seward et al.
==18328== For more details, rerun with: -v
==18328== 
data = HelloWorld
==18328== Invalid read of size 4
==18328==    at 0x76751E6: std::basic_ostream<char, std::char_traits<char> >& std::operator<< <char, std::char_traits<char>, std::allocator<char> >(std::basic_ostream<char, std::char_traits<char> >&, std::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (in /usr/lib/libstdc++.so.6.0.3)
==18328==    by 0x804A199: Product::send1(Generator*) (product.cpp:43)
==18328==    by 0x8049A84: Generator::test() (generator.cpp:60)
==18328==    by 0x8048F4B: Configure::init() (configurator.cpp:89)
==18328==    by 0x8048C92: main (appLaunch.cpp:20)
==18328==  Address 0x5C040234 is not stack'd, malloc'd or (recently) free'd
==18328== 
==18328== Process terminating with default action of signal 11 (SIGSEGV)
==18328==  Access not within mapped region at address 0x5C040234
==18328==    at 0x76751E6: std::basic_ostream<char, std::char_traits<char> >& std::operator<< <char, std::char_traits<char>, std::allocator<char> >(std::basic_ostream<char, std::char_traits<char> >&, std::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (in /usr/lib/libstdc++.so.6.0.3)
==18328==    by 0x804A199: Product::send1(Generator*) (product.cpp:43)
==18328==    by 0x8049A84: Generator::test() (generator.cpp:60)
==18328==    by 0x8048F4B: Configure::init() (configurator.cpp:89)
==18328==    by 0x8048C92: main (appLaunch.cpp:20)
==18328== 
==18328== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 17 from 1)
==18328== malloc/free: in use at exit: 159 bytes in 5 blocks.
==18328== malloc/free: 5 allocs, 0 frees, 159 bytes allocated.
==18328== For counts of detected errors, rerun with: -v
==18328== searching for pointers to 5 not-freed blocks.
==18328== checked 116,636 bytes.

这实际上是一个更大的应用程序的一部分，但我已经剥离了应用程序并使其非常小，以便我可以轻松调试问题，但即使现在我也不知道为什么会出现这个问题。使用 gdb 我尝试检查内存布局，但在调用函数之前和之后，内存地址和内容看起来完好无损。事实上，如果我尝试使用 gdb 打印功能打印数据的值，结果是正确的。我尝试了很多事情，比如在堆上分配内存等，但似乎没有任何效果。请您指导我如何开始调试此问题。

Answer 1

很高兴看到 send1 的声明和实现，否则很难提供帮助。 Product/Generator 有虚函数吗？

为什么要写 cout data

尝试将 Product::send1(Generator* genptr) 更改为 Product::send1(const Generator& gen) 并使用 ptr->send1(*this) 调用它，看看是否有同样的问题。

Answer 2

我最好的猜测是 genptr 已被删除/销毁，但是当您在调试器中打印出 genptr->data 的内容时，它使用的内存尚未被覆盖。但是，ostream operator<< 函数在内部分配了一些内存，并且恰好重用了相同的空间，因此它在实际运行并尝试打印字符串时被覆盖，从而导致崩溃。

您可以通过查看 SEGV 之后 0x9917020（genptr 指向的位置）的内存来检查这一点，看看它是否发生了变化。您应该可以在上面的最终 gdb 提示符处执行 up 和 p genptr->data。